Unable to enter firmware flashing mode

I toggled the DSW2-7 DIP switch to ON, but I don’t see anything on the serial console.

I’ve connected to the serial console on the back of the board that is covered by the faceplate.

The reason I’m trying to reflash the firmware is that the board I received doesn’t bootup with the following error:

NOTICE:  OP-TEE has not been loaded by SCP firmware
NOTICE:  BL31: v2.0(release):v1.5-1432-ge86e202
NOTICE:  BL31: Built : 18:28:09, Feb 12 2019
ERROR:   Error initializing runtime service opteed_fast

Any help appreciated.

LS-UART0 is on the low speed connector, duh.

Reflashing with the system firmware using xmodem didn’t help though. I still see DDR init errors.

/ __|/ __| _ \                                                                      
 \__ \ (__|  _/                                                                      
 |___/\___|_|                                                                        
System Control Processor                                                             
Entered RAM Firmware                                                                 
v2.5.0_2019-09-17_13-24-55-v2.5.0-20-g3788534                                        
[scmi_vendor_ext] process bind request.                                              
[PPUV0] get state reg=0x50021000 (0x1)                                               
[PPUV0] get state reg=0x50043000 (0x1)                                               
[PPUV0] get state reg=0x50042000 (0x1)                                               
[PPUV0] get state reg=0x50044000 (0x1)                                               
[PPUV0] get state reg=0x501c1000 (0x0)                                               
[PPUV0] get state reg=0x501a1000 (0x0)                                               
[PPUV0] get state reg=0x50181000 (0x0)                                               
[PPUV0] get state reg=0x50161000 (0x0)                                               
[PPUV0] get state reg=0x50141000 (0x0)                                               
[PPUV0] get state reg=0x50121000 (0x0)                                               
[PPUV0] get state reg=0x50101000 (0x0)                                               
[PPUV0] get state reg=0x500e1000 (0x0)                                               
[PPUV0] get state reg=0x500c1000 (0x0)                                               
[PPUV0] get state reg=0x500a1000 (0x0)                                               
[PPUV0] get state reg=0x50081000 (0x0)                                               
[PPUV0] get state reg=0x50061000 (0x0)                                               
[SYNQUACER SYSTEM] chip version 2.                                                   
[SYSTEM] Initializing power domain                                                   
[PowerDomain] Socionext-PPU initialize .                                             
[PowerDomain] Socionext-PPU initialize end .                                         
[PowerDomain] PowerDomain All-ON start.                                              
[PPU] sni-pmu timeout expected:(0xfffffc00) result: (0xfffc0000).                    
[PowerDomain] Opening transaction switch                                             
[PowerDomain] Finished transaction switch                                            
[PowerDomain] PowerDomain All-ON finished.                                           
[THERMAL] Thermal enable start                                                       
[THERMAL] Thermal enable end                                                         
[SYSTEM] Starting check DRAM                                                         
[SYSTEM] slot DIMM1: 16384MB RDIMM ECC                                               
[SYSTEM] Finished check DRAM memory total 16GB                                       
[SYNQUACER SYSTEM] Request system initialization.
[CCN512] Initialising ccn512 at 0xd2000000                                           
[CCN512] CCN512 init done.
[DDR] 2133MHz
[DDR] Initializing DDR ch0
[DDR] error : Write Leveling, Gate Training, Write Leveling Adjust
[DDR] ddr_init_train_mp Write Leveling Adjustment Error
[DDR] [DDR] ch0 fatal error occurred.
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)
DDR Initialize Failed.(0x3014)

The firmware flashing page talks about a recommended firmware(ramfw_20171102.bin), but I can’t seem to find it.

As far as I recall we were never given a license to redistribute the binaries for ramfw_20171102.bin so the best we could do was quote the sha1sum…

In principle ramfw_20171102.bin was superseded by the open source SCP release (Build Source for Developerbox - 96Boards ) so it might have worth giving that a try (my 'box still runs with the original factory SCP firmware so this isn’t direct experience).

I haven’t got a 'box near me right now to check what “known working” boot messages look like but is this message saying you have only one slot populated? I’ve only ever seen a devbox with two slots populated…

I’ve already built my own firmware and tried, but that didn’t work. I’ve also tried the instructions on another thread to get OP-TEE work, but that didn’t help either.

I’ve tried to unpack UEFI capsule to get the original firmware, but no luck getting detecting the cap file yet. Is the factory firmware available someplace?

Factory binary is now available at:

https://git.linaro.org/people/masahisa.kojima/edk2-non-osi.git/tree/Platform/Socionext/DeveloperBox?h=synquacer-add-factory-binary

  • 20180226-LB1.1-ACPI-ramfw.bin

Socionext now can redistribute SCP-firmware binary.

[SYSTEM] slot DIMM1: 16384MB RDIMM ECC
[SYSTEM] Finished check DRAM memory total 16GB

If you use one DIMM only, please insert it to DIMM2 slot instead of DIMM1.
We recommend to use two DIMMs in DIMM1/2 slots.

Thanks! I’ll try this out today.

What is the difference between fip_all_arm_tf_mm.bin and fip_all_arm_tf.bin firmware.

I should use the one without mm?

I use a single DIMM in DIMM2 slot already. I’ve tried reseating DIMM, but still see errors.

I should use the one without mm?

You can use the one without mm for normal use.
fip_all_arm_tf_mm.bin supports UEFI authenticated variable.

ERROR: Error initializing runtime service opteed_fast

This error just appears when Developerbox is booted without OP-TEE,
system should boot successfully even if this error appears.

This stock firmware behaved a bit better, no more ddr errors.

But still no luck booting completely.

The console shows the following after flashing 20180226-LB1.1-ACPI-ramfw.bin using flash write cm3:

NOTICE:  BL31: v2.0(release):e86e202c2e4e
NOTICE:  BL31: Built : 03:29:40, Nov 17 2020

I then flashed fip_all_arm_tf.bin using flash write arm-tf which gave the following messages on the console:

NOTICE:  OP-TEE has not been loaded by SCP firmware
NOTICE:  BL31: v2.0(release):v1.5-1432-ge86e202
NOTICE:  BL31: Built : 18:28:09, Feb 12 2019
ERROR:   Error initializing runtime service opteed_fast

Notice the build time stamp difference.

There is also possibly some discrepancy in the docs.

Which of the following is the correct command?
flash write cm3
or
flash write p-master-cm3 ?

Where can I get the option ROM for this command: flash write s-mir-cm3

Is there a list of all parameters that flash write can take? I’m looking for a sequence of commands that can overwrite any bad changes and restore the box to pristine factory firmware.

Thanks for your help.

flash write cm3 is correct.
Sorry for the confusion.

You can get the available parameters by entering flash write

Command Input >flash write
Command'flash'Start...
Usage: flash write (config|cm3|arm-tf|uefi) [max_size]

Could you flash the latest working tf-a and uefi binary?

  1. download latest binary
    http://snapshots.linaro.org/components/kernel/leg-96boards-developerbox-edk2/85/SPI_NOR_IMAGE.fd-DEBUG
    This file includes both tf-a and uefi binaries.

  2. Update NOR flash
    flash rawwrite 180000 280000
    then send SPI_NOR_IMAGE.fd-DEBUG via XMODEM

If you use graphic card on Developerbox, could you remove it then try?

Thanks @masahisak.

After reflashing with flash write cm3 and flash rawrite 180000 280000 with the binaries you’ve provided, I have gotten a bit further. Here is my log:

NOTICE:  OP-TEE has not been loaded by SCP firmware
NOTICE:  BL31: v2.0(release):v1.5-1432-ge86e202
NOTICE:  BL31: Built : 18:28:09, Feb 12 2019
ERROR:   Error initializing runtime service opteed_fast
Register PPI Notify: DCD0BE23-9586-40F4-B643-06522CED4EDE
Install PPI: 8C8CE578-8A3D-4F1C-9935-896185C32DD3
Install PPI: 5473C07A-3DCB-4DCA-BD6F-1E9689E7349A
The 0th FV start address is 0x00008200000, size is 0x001D0000, handle is 0x8200000   
Register PPI Notify: 49EDB1C1-BF21-4761-BB12-EB0031AABB39                            
Register PPI Notify: EA7CA24B-DED5-4DAD-A389-BF827E8F9B38                            
Install PPI: B9E0ABFE-5979-4914-977F-6DEE78C278A6                                    
Install PPI: DBE23AA9-A345-4B97-85B6-B226F1617389                                    
Install PPI: 6847CC74-E9EC-4F8F-A29D-AB44E754A8FC
DiscoverPeimsAndOrderWithApriori(): Found 0xB PEI FFS files in the 0th FV
Loading PEIM 9B3ADA4F-AE56-4C24-8DEA-F03B7558AE50
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/MdeModulePkg/Universal/PCD
/Pei/Pcd/DEBUG/PcdPeim.dll 0x8211240
Loading PEIM at 0x00008211160 EntryPoint=0x00008212008 PcdPeim.efi
Install PPI: 06E81C58-4AD7-44BC-8390-F10265F72480
Install PPI: 01F34D25-4DE2-23AD-3FF3-36353FF323F1
Install PPI: 4D8B155B-C059-4C8F-8926-06FD4331DB8A
Install PPI: A60C6B59-E459-425D-9C69-0BCC9CB27D81
Register PPI Notify: 605EA650-C65C-42E1-BA80-91A52AB618C6
Loading PEIM AAC33064-9ED0-4B89-A5AD-3EA767960B22
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/MdeModulePkg/Universal/Fau
ltTolerantWritePei/FaultTolerantWritePei/DEBUG/FaultTolerantWritePei.dll 0x8222240
Loading PEIM at 0x00008222160 EntryPoint=0x00008223874 FaultTolerantWritePei.efi
FtwPei: Work block header valid bit check error
FtwPei: Both working and spare block are invalid.
Install PPI: 1D3E9CB8-43AF-490B-830A-3516AA532047
Loading PEIM 34C8C28F-B61C-45A2-8F2E-89E46BECC63B
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/MdeModulePkg/Universal/Var
iable/Pei/VariablePei/DEBUG/PeiVariable.dll 0x8225240
Loading PEIM at 0x00008225160 EntryPoint=0x00008225E04 PeiVariable.efi
Install PPI: 2AB86EF5-ECB5-4134-B556-3854CA1FE1B4
Loading PEIM C779F6D8-7113-4AA1-9648-EB1633C7D53B
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/MdeModulePkg/Universal/Cap
sulePei/CapsulePei/DEBUG/CapsulePei.dll 0x8229240
Loading PEIM at 0x00008229160 EntryPoint=0x0000822C364 CapsulePei.efi
Install PPI: 3ACF33EE-D892-40F4-A2FC-3854D2E1323D
Loading PEIM 55A981A5-F371-4BA3-93A5-37FA0CA95089
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/Silicon/Socionext/SynQuace
r/Drivers/SynQuacerGpioPei/SynQuacerGpioPei/DEBUG/SynQuacerGpioPei.dll 0x822E240
Loading PEIM at 0x0000822E160 EntryPoint=0x0000822F49C SynQuacerGpioPei.efi
Install PPI: 21C3B115-4E0B-470C-85C7-E105A575C97B
Loading PEIM 90B2B846-CA6D-4D6E-A8D3-C140A8E110AC
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/Platform/Socionext/Develop
erBox/SystemFirmwareDescriptor/SystemFirmwareDescriptor/DEBUG/SystemFirmwareDescriptor.dll 0x8231240
Loading PEIM at 0x00008231000 EntryPoint=0x00008232338 SystemFirmwareDescriptor.efi
EDKII_SYSTEM_FIRMWARE_IMAGE_DESCRIPTOR size - 0xCE
Loading PEIM 2AD0FC59-2314-4BF3-8633-13FA22A624A0
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/ArmPlatformPkg/PlatformPei
/PlatformPeim/DEBUG/PlatformPei.dll 0x8217240
Loading PEIM at 0x00008217160 EntryPoint=0x00008218448 PlatformPei.efi
Platform PEIM Loaded
Install PPI: 3E1D7356-DDA4-4B1A-9346-BF891C8646CC
Install PPI: 7408D748-FC8C-4EE6-9288-C4BEC092A410
Loading PEIM C61EF796-B50D-4F98-9F78-4F6F79D800D5
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/ArmPlatformPkg/MemoryInitP
ei/MemoryInitPeim/DEBUG/MemoryInit.dll 0x821A240
Loading PEIM at 0x0000821A160 EntryPoint=0x0000821A4BC MemoryInit.efi
Memory Init PEIM Loaded
PeiInstallPeiMemory MemoryBegin 0xF8000000, MemoryLength 0x8000000
Firmware Volume for Variable Store is corrupted

Could you set DSW3-1 to ON, then try again?
This setting is for erasing the UEFI variable store.

I set DSW3-1 to ON and booted. I see the following logs confirming that the NVRAM was cleared:

/PlatformPeim/DEBUG/PlatformPei.dll 0x8217240
Loading PEIM at 0x00008217160 EntryPoint=0x00008218448 PlatformPei.efi
Platform PEIM Loaded
PlatformPeim: clearing NVRAM
Install PPI: 3E1D7356-DDA4-4B1A-9346-BF891C8646CC
Install PPI: 7408D748-FC8C-4EE6-9288-C4BEC092A410
Loading PEIM C61EF796-B50D-4F98-9F78-4F6F79D800D5
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/ArmPlatformPkg/MemoryInitP
ei/MemoryInitPeim/DEBUG/MemoryInit.dll 0x821A240
Loading PEIM at 0x0000821A160 EntryPoint=0x0000821A4BC MemoryInit.efi
Memory Init PEIM Loaded
PeiInstallPeiMemory MemoryBegin 0xF8000000, MemoryLength 0x8000000

But now, if I switch DS3-1 to OFF and restart, I get the same corruption error.

But now, if I switch DS3-1 to OFF and restart, I get the same corruption error.

Could you also try to erase the UEFI variable store region from flash writer?

flash rawwrite 0x00400000 0x00020000

Command Input >flash rawwrite 0x00400000 0x00020000
Command'flash'Start...
HsspiSoftwareReset()...RDSR=40
[INFO] ManufacturerID=C2 DeviceID=25 RDSR=00
[INFO] DeviceName=MX66U1G45G (256bytes per programmable page)
Showing status registers. RDSR = 0x00000040, Enter 4-byte mode
HsspiSectorErase. Please wait...
 End.SectorErase(65/65)...
Writing data at offset 0x00400000, max_size 0x00020000
Waiting to receive the data in XMODEM protocol (128bytes check-sum)...

After “Waiting to receive the data in XMODEM protocol (128bytes check-sum)…” message appears, please just power off the board without sending any data via XMODEM.
Then, could you check the system boots?

Tried clearing the UEFI variable store region with and without DSW3-1 set to ON.

I still see Firmware Volume for Variable Store is corrupted as soon as I switch DSW3-1 to OFF

It seems that there are hardware errors.

Do you purchase Developerbox from chip1stop?

Could you read the warranty document and follow the instruction?

Thank you very much for taking your time to investigate this issue.

It was a Linaro box :slight_smile:

I see the following logs with DSW3-1 set to ON.

NOTICE:  OP-TEE has not been loaded by SCP firmware
NOTICE:  BL31: v2.0(release):v1.5-1432-ge86e202
NOTICE:  BL31: Built : 18:28:09, Feb 12 2019
ERROR:   Error initializing runtime service opteed_fast
Register PPI Notify: DCD0BE23-9586-40F4-B643-06522CED4EDE
Install PPI: 8C8CE578-8A3D-4F1C-9935-896185C32DD3
Install PPI: 5473C07A-3DCB-4DCA-BD6F-1E9689E7349A
The 0th FV start address is 0x00008200000, size is 0x001D0000, handle is 0x8200000
Register PPI Notify: 49EDB1C1-BF21-4761-BB12-EB0031AABB39
Register PPI Notify: EA7CA24B-DED5-4DAD-A389-BF827E8F9B38
Install PPI: B9E0ABFE-5979-4914-977F-6DEE78C278A6
Install PPI: DBE23AA9-A345-4B97-85B6-B226F1617389
Install PPI: 6847CC74-E9EC-4F8F-A29D-AB44E754A8FC
DiscoverPeimsAndOrderWithApriori(): Found 0xB PEI FFS files in the 0th FV
Loading PEIM 9B3ADA4F-AE56-4C24-8DEA-F03B7558AE50
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/MdeModulePkg/Universal/PCD
/Pei/Pcd/DEBUG/PcdPeim.dll 0x8211240
Loading PEIM at 0x00008211160 EntryPoint=0x00008212008 PcdPeim.efi
Install PPI: 06E81C58-4AD7-44BC-8390-F10265F72480
Install PPI: 01F34D25-4DE2-23AD-3FF3-36353FF323F1
Install PPI: 4D8B155B-C059-4C8F-8926-06FD4331DB8A
Install PPI: A60C6B59-E459-425D-9C69-0BCC9CB27D81
Register PPI Notify: 605EA650-C65C-42E1-BA80-91A52AB618C6
Loading PEIM AAC33064-9ED0-4B89-A5AD-3EA767960B22
add-symbol-file /home/buildslave/workspace/leg-96boards-developerbox-edk2/Build/DeveloperBox/DEBUG_GCC5/AARCH64/MdeModulePkg/Universal/Fau
ltTolerantWritePei/FaultTolerantWritePei/DEBUG/FaultTolerantWritePei.dll 0x8222240
Loading PEIM at 0x00008222160 EntryPoint=0x00008223874 FaultTolerantWritePei.efi
FtwPei: Work block header valid bit check error
FtwPei: Both working and spare block are invalid.
Install PPI: 1D3E9CB8-43AF-490B-830A-3516AA532047
Loading PEIM 34C8C28F-B61C-45A2-8F2E-89E46BECC63B

Is the FtwPei error above acceptable? Any way to fix it?

Hi, today I failed to FW update and bricked my DeveloperBox.

I’m seeing the following message on USB-serial console.

NOTICE: OP-TEE has not been loaded by SCP firmware
NOTICE: BL31: v2.0(release):v1.5-1432-ge86e202
NOTICE: BL31: Built : 18:28:09, Feb 12 2019
ERROR: Error initializing runtime service opteed_fast

Whenever I press reset button, the lines above are re-emitted. No graphics is displayed on LCD screen.

It’s not clear for me what’s the real cause, missing optee module in flash or so, and how I can salvage my bricked SynQuacer unit. Any help is welcome.

The general recovery document is here: Developerbox Board Recovery - 96Boards

What you probably need is System firmware recovery → Update using serial flasher .

However this does require that you have a 1.8v UART attached to LS-UART0. If you do not have this then it is still possible to proceed but I’m afraid the documentation gets a little more vague.

The short answer is that the Developerbox has a built-in tool free debrick mechanism. Specifically you can program the SPINOR by bitbanging the JEDEC SPI protocol using the console UART. This is very slow (as in, needs to run overnight, kind of speeds) but does not need any specialist hardware.

I wrote up some documentation for this but it is not merged into the main repository because parts of it are untested:

This documentation is (at least) 90% correct but it was reconstructed from my logbook so a few of the bullets are marked [UNTESTED] because I did not test these exact commands (my testing of the flashrom tools was undertaken using older firmware). Also this document shows how to update the SCP firmware and it looks like, in your case, is is the system firmware ( 0200000:03fffff uefi) that is most likely to be corrupt so you will have to adapt them a little bit.

In short, the flashrom tool is powerful enough to allow you to change every single byte in your Developerbox firmware ROM (and therefore can debrick no matter what happens). However I’m a little out of date so I can help you with the tool but I don’t know exactly what to tell you to write with it!

Thanks for details.

Probably the silliest Q at first. Where is LS-UART0 ? Somewhere near to micro-B USB console?
I can see 4pin header along side CP2102 USB-UART bridge.

According to SynQuacer schematic, CP2102 GPIO lines are hooked to SPINOR which is
likely the way to bitbang’g NOR update that #SPI-recovery section above explains.

I tried UEFI update from factory default board condition. Image was fetched from 96boards.org site
as DeveloperBox.Cap. Due to a bad luck, progress bar on splash screen stucked in the middle and I reluctantly pressed the reset button after 10min dohdoh.